We help IT Professionals succeed at work.

Cisco SPAN and RSPAN

jskfan asked
I have done some reading about Cisco Switches SPAN and RSPAN, but I don't understand the purpose of using it.
Is it a process that will alert the network Admin about the switch issues,kind of real time monitoring and alerting, or it is something that logs  events and the Admin will have to go at later time and read the events??

Watch Question

SPAN and RSPAN are features that allow you to receive packets on one port that are actually forwarded to and from other ports on the switched LAN.  This can be used for troubleshooting (connecting your laptop with sniffer software, like Wireshark, to a destination port), or connecting an Intrution Detection System or other hardware based network analyser to the network.

It does not scale very well, as the destination port can easily get flooded if the source-ports are getting busy, but it is quite useful if you want to be able to see the actual traffic a particular host generates or receives.  It sure beat having to install a dumb hub to the physical cabling.
It acts as monitoring tool ..specially used when sniffer is installed to know what is going on Network port.

You suspect a PC connected on port f0/1 or u see high traffic then usual on trunk port .
U installe SNIFFER to know packet details for e.g Etherreal S/W on machine which acts as sniffer.

monitor 1 session source port g0/1 destination g0/24..
So all traffic on port g0/1 is also send to g0/24 were we capture the traffic and analyze ..

Note syntax might not be exact but it will be near to it ..